ytnef versions up to 2.1.2 contain a heap out‑of‑bounds read inside the MAPIPrint() routine. By supplying a crafted winmail.dat file whose decompressed RTF payload omits the terminating NUL byte, an attacker can cause the internal printf call to read beyond the intended buffer. This over‑read can result in a crash of ytnefprint and the leakage of adjacent heap bytes, potentially revealing sensitive data stored in memory. The vulnerability does not lead to code execution, but it grants an attacker the ability to retrieve arbitrary information from the process address space.

The affected vendor is Yeraze, with the ytnef project. All releases of ytnef through version 2.1.2 are affected. Versions 2.1.3 and later are believed to contain the fix.

The CVSS v3 score is 6.9, indicating a medium severity disclosure. The EPSS score is below 1 %, suggesting a low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote file ingestion; an attacker must supply a malicious winmail.dat payload to cause the over‑read. Given the lack of a remote code execution path and the low EPSS, the overall risk is moderate, but any system that processes untrusted winmail.dat files should address it promptly.